Whenever app messages become part of an investigation, one question returns: why cannot the company behind the app simply hand over every conversation?
The Daniel Vorcaro case brought that question into Brazil's public debate. According to reports based on Federal Police material, part of the reconstruction of communications may have come from traces found on the device itself, including screenshots, temporary files and activity records.
That leads to an important distinction. Examining a phone is different from breaking WhatsApp encryption.
What reports describe about the case
The technical point is the path the content took before reaching WhatsApp. According to the reconstruction presented by investigators and reported by outlets such as Folha and CNN, some messages were written in the Notes app, turned into screenshots and sent as view-once images.
Investigators reportedly correlated those files with timestamps, app-opening records and other device data. This kind of correlation can help build a sequence of events, but it does not by itself prove the content of a conversation or replace a court's assessment of the material.
The case helps explain a distinction that often disappears in public debate. An investigation may find a copy created before sending or a trace left after opening without obtaining the key that protects the message during transport.
What end-to-end encryption protects
With end-to-end encryption, a message is protected on the sender's device and becomes readable again only on the recipient's device. The server helps deliver the data, but it does not need to hold the key that can read the content.
WhatsApp says personal messages and calls are protected this way. Meta says the Signal Protocol is a foundation of WhatsApp encryption. WhatsApp Help Center, Meta Engineering.
The protection applies to the path. It does not stop someone from copying the text before sending it, taking a screenshot or photographing the screen after the message appears.
Why the method attributed to Vorcaro was not real protection
According to investigative material reproduced by the press, Vorcaro wrote messages in the Notes app, took a screenshot and sent the image through WhatsApp using view once.
That procedure may look like a way to reduce traces. Technically, it creates new copies before the image is even sent.
The content may exist in the notes app, the screenshot, the image history, backups, system records and the recipient's screen.
View once limits the normal lifetime of media inside WhatsApp. WhatsApp says the recipient cannot take a regular screenshot, but it also acknowledges that someone can photograph or record the screen with a camera or another device before the content disappears. WhatsApp Help Center.
Many people now have a second phone, a tablet or a laptop nearby. Pointing another camera at the screen is enough. Encryption cannot prevent it because the content has already been decrypted and is visible.
If information appears on a screen, it can be recorded.
Where Diffie-Hellman fits
Diffie-Hellman allows two people to arrive at the same secret without sending that secret directly over the internet.
Alice and Bob choose private values. They calculate public values and exchange only those public values. Both then derive the same shared secret.
An observer sees the public values. The challenge is recovering the private values from them. With suitable parameters, that calculation is considered computationally infeasible with known resources.
Diffie-Hellman does not send a ready-made key. It lets both sides build the same secret without exposing it directly.
WhatsApp does not rely on one permanent key
Modern messaging apps must handle asynchronous conversations, multiple devices and possible compromise. The Signal Protocol therefore combines key agreement, authentication, key derivation and continuous renewal.
X3DH helps start a session when both people are not online at the same time. Double Ratchet updates keys throughout the conversation and can use different keys for different messages. X3DH specification, Double Ratchet specification.
This architecture limits the impact of an exposed key. A current key should not automatically reveal the entire history. There is an important limit, though: if a device is compromised, the protocol cannot guarantee that the content remains protected.
The investigation surface may be the endpoint
A forensic investigation does not have to intercept a message while it is being sent. It can look for traces left on the devices.
Those traces may include screenshots, saved images, temporary files, notifications, local databases, backups, creation times and deleted data that has not yet been overwritten.
Reports about the Vorcaro case mentioned notes, screenshots and correlations between records on the phone. Folha described a reconstruction based on device artifacts. CNN also reported a cross-check between screenshots, temporary files and app activity records. Folha de S.Paulo, CNN Brasil.
That does not mean WhatsApp delivered the messages in clear text. The information may have been found in a copy made by the user, an image, a backup or another device record.
The lesson for companies
A company can protect communication between two systems and still leave copies spread across laptops, phones, downloads, email, spreadsheets, backups and support tools.
When designing a system, teams need to know where data is created, where it is decrypted, who can see it, which copies are made, where keys live and which records remain.
Choosing an algorithm is only part of the work. Security depends on the full flow of information.
The Vorcaro case made that distinction visible. A message can be protected on the way and still leave traces on the devices involved.
At Arxon, security starts with process design: which data exists, who should access it, where keys live and which surfaces remain exposed.
João Oliveira
Arxon
Comments
No comments yet. Start the conversation.